Account takeover is the most frequent: attackers reuse leaked passwords at scale or phish one-time codes, then move money out before the customer notices. API abuse targets weak authentication or missing rate limits on payment and account endpoints. Ransomware encrypts systems and now usually steals data first to add extortion pressure. Supply-chain attacks come through a compromised vendor, SDK or managed service with access to production. In crypto, theft of the private keys that control hot wallets can empty them in a single transaction.

DORA requires an ICT risk management framework approved by the management body, covering identification, protection, detection, response and recovery. Under Article 19, major ICT-related incidents must be reported to the competent authority in three stages: an initial notification, an intermediate report when the situation changes significantly, and a final report once root cause analysis is complete, with actual impact figures replacing estimates.

Under Article 26, firms that their competent authority identifies, based on their impact and ICT risk profile, must run threat-led penetration testing at least every three years; microenterprises are excluded. DORA also requires a register of all ICT third-party arrangements and tested exit strategies for providers supporting critical or important functions.

Card businesses add PCI DSS, the card industry's security standard, which applies to every entity that stores, processes or transmits cardholder data, with PCI DSS validation requirements set by transaction volume.

GDPR Article 33 requires a controller to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, where feasible, and to explain any delay. Fines for failures in security and breach handling reach up to €10 million or 2% of worldwide annual turnover, whichever is higher; breaches of the core processing principles reach €20 million or 4%.

Illustrative example: for a fintech with €150 million of worldwide turnover, 2% is €3 million, so the lower-tier cap is €10 million. For a group with €1 billion of turnover, 2% is €20 million, which becomes the cap. An incident management process that classifies an incident within hours decides whether both the DORA and GDPR clocks are met.

The licensed entity is the GDPR controller and the DORA-regulated firm, so the buyer inherits past incidents and any undisclosed breach. Diligence reviews penetration test reports and remediation status, the incident register and DORA reports filed, PCI DSS attestations, privileged-access controls and, for crypto firms, how wallet keys are generated, stored and recovered. Material gaps are usually handled with a specific indemnity or escrow rather than a price cut alone.